Endor Labs

Visit site Alternatives

Score7.3

Rank#2 of 64

PriceFree

Free planYes

Runs onAPI, Linux, macOS, Web, Windows

Summary

Endor Labs is an application security platform for code, dependencies, secrets, container images, and AI coding agents. AURI for Developers can scan for vulnerabilities, find secrets, and block malicious dependencies in AI coding workflows. Endor Code provides AI-based static application security testing and secrets detection; Endor Open Source adds reachability analysis, malicious-package detection, AI model governance, and SBOM and VEX generation. Teams can inventory coding agents, models, MCP servers, and skills, then apply policies to agent actions. Scans can run through cloud apps, within CI/CD runners, or through Endor Outpost for scheduled monitoring and on-premises deployment. Endor Labs says cloud scanning briefly clones code into a container that is destroyed after scanning; CI/CD scans keep code in the runner. The free Developer tier provides local scanning and read-only vulnerability data, but has no UI, policies, or scan history. It is available on Linux, macOS, Windows, web, and API. The company was founded in Palo Alto in 2021.

Who it is for

It suits development and security teams that need to scan code and dependencies or govern AI coding agents. The free tier may suit individual developers who want local scans.

What is good

Scans code, secrets, dependencies, and container images.
Supports reachability analysis and SBOM generation.
Offers local scans in its free Developer tier.
Can run scans in CI/CD runners or on-premises.
Lists integrations with code hosts and coding assistants.

What to know first

Free tier has no UI, policies, or scan history.
Paid plan prices require contacting sales.
Paid plans use annual fair-usage quotas.

Verdict

Endor Labs combines application security scanning with controls for AI coding agents. The free tier is limited to local scans and read-only vulnerability data; team features require a paid plan.

Endor Labs plans and pricing

All plans

Developer Free FREE Individual developers · local scans via AURI MCP server · no account required · no UI, policies, or scan history endorlabs.com · 3 Oct 2026

Core Not published Contact sales Paid team tier · reachability · prioritization · policies · pricing is seat-based endorlabs.com · 3 Oct 2026

Pro Not published Contact sales Paid team tier · advanced vulnerability detection, triage, and remediation across application layers · pricing is seat-based endorlabs.com · 3 Oct 2026

Compared on software composition analysis software

Free plan: Yesendorlabs.com

Facts

Product: Endor Labs describes its platform as an application security platform spanning coding agents, code, secrets, dependencies, package firewall, and container images.endorlabs.com · 3 Oct 2026
AURI: AURI for Developers helps scan and fix vulnerabilities, detect secrets, and block malicious dependencies in an AI coding workflow.endorlabs.com · 3 Oct 2026
Scanning: Endor Code provides AI SAST and secrets detection, while Endor Open Source provides reachability-based SCA, malicious package detection, AI model governance, and SBOM and VEX generation.endorlabs.com · 3 Oct 2026
Agent governance: The platform can inventory coding agents, models, MCP servers, and skills and enforce policies on agent actions.endorlabs.com · 3 Oct 2026
Integrations: The site lists integrations including GitHub, GitLab, Bitbucket, CircleCI, Jenkins, Jira, Slack, Vanta, Cursor, Claude, Gemini, and GitHub Copilot.endorlabs.com · 3 Oct 2026
Deployment: Customers can scan through cloud apps, inside CI/CD runners, or use Endor Outpost for scheduled monitoring scans and on-premises deployment.endorlabs.com · 3 Oct 2026
Source code handling: Endor Labs says it does not store customer source code; cloud scanning briefly clones code to a container and destroys it after scanning, while CI/CD scanning keeps code in the runner.endorlabs.com · 3 Oct 2026
Free tier limits: The Developer tier scans locally and provides read-only access to vulnerability data, without a UI, policies, or scan history.endorlabs.com · 3 Oct 2026
Paid plan limits: Paid plans use annual fair usage quotas based on purchased seats, and the page says users are not blocked from scanning when they exceed those limits.endorlabs.com · 3 Oct 2026
Pricing model: Pricing is seat-based; for Endor Code and Endor Open Source, a contributing developer is someone who committed to a monitored repository within the last 90 days.endorlabs.com · 3 Oct 2026
Support: Endor Labs offers multiple Technical Success tiers tailored to team needs and deployment complexity.endorlabs.com · 3 Oct 2026
Security controls: AURI agents run on the customer's infrastructure, are read-only by default, and ask for approval before mutating actions.endorlabs.com · 3 Oct 2026
Developer platforms: The endorctl CLI installation instructions cover macOS through Homebrew, Linux, and Windows, and the product also offers a web UI and REST API for paid plans.endorlabs.com · 3 Oct 2026
Company history: Endor Labs says it was founded in Palo Alto, California, in 2021.endorlabs.com · 3 Oct 2026